Zone migration in network access

• US 9,141,773 B2
• Filed: 10/18/2013
• Issued: 09/22/2015
• Est. Priority Date: 07/07/2009
• Status: Active Grant

• Current Assignee: Nomadix, Inc. (Nippon Telegraph and Telephone Corporation)
• Original Assignee: Nomadix, Inc. (Nippon Telegraph and Telephone Corporation)
• Inventors: Olshansky, Vadim, Noro, Raffaele
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): WYSZYNSKI, AUBREY H
• Application Number:
  US14/057,481
• Publication Number:
  US 20140047514A1
• Time in Patent Office: 704 Days
• Field of Search: 726/4
• US Class Current: 1/1
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

The present disclosure is directed to providing a network user the ability to travel between different zones or locations within a network environment, such as, for example, a hospitality location, without requiring a user to re-login to the new location, while requiring a user to re-login to other locations within the network environment.

Claims

1. A method for determining whether to allow a computer communicating with a first network access point within a privately controlled computer network including multiple network access points to migrate from one network access point to another network access point at a different location within the network without re-authentication, the method comprising:

storing migration permissions, at a network management system, for migrating between individual network access points in the plurality of network access points, where the migration permissions establish migration rights between individual network access points in a plurality of network access points, said plurality of network access points configured to provide a computer access to a privately controlled computer network; and

determining, at the network management system, whether to require the computer to re-authenticate in order to migrate from communicating with a first network access point in the plurality of network access points to a second network access point in the plurality of network access points based on a subscription level of the computer.

2. The method of claim 1, wherein the subscription level of the computer depends at least on the first network access point.

3. The method of claim 2, wherein the subscription level of the computer depends at least on the location of the first network access point.

4. The method of claim 1, further comprising, sending authentication request to the computer based on the determination.

5. The method of claim 1, wherein the network access point is a port.

6. The method of claim 5, wherein the port is a VLAN port.

7. The method of claim 1, further comprising, receiving instructions for defining a plurality of zones, wherein each zone includes at least one network access point.

8. The method of claim 7, wherein the subscription level of the computer depends at least on the zone of the first network access point.

9. The method of claim 7, wherein at least one SSID is assigned to at least one zone in the plurality of zones.

10. A system for determining whether to allow a computer communicating with a first network access point within a privately controlled computer network including multiple network access points to migrate from one network access point to another network access point at a different location within the network without re-authentication, comprising:

a hardware memory configured to store migration permissions for migrating between individual network access points in the plurality of network access points, where the migration permissions establish migration rights between individual network access points in a plurality of network access points, said plurality of network access points configured to provide a computer access to a privately controlled computer network; and

a hardware processor which determines whether to require the computer to re-authenticate in order to migrate from communicating with a first network access point in the plurality of network access points to a second network access point in the plurality of network access points based on a subscription level of the computer.

11. The system of claim 10, wherein the subscription level of the computer depends at least on the first network access point.

12. The system of claim 11, wherein the subscription level of the computer depends at least on the location of the first network access point.

13. The system of claim 10, wherein the hardware processor further sends authentication request to the computer based on the determination.

14. The system of claim 10, wherein the hardware processor further receives instructions for defining a plurality of zones, wherein each zone includes at least one network access point.

15. The system of claim 14, wherein the subscription level of the computer depends at least on the zone of the first network access point.

16. A system for determining whether to allow a computer communicating with a first network access point within a privately controlled computer network including multiple network access points to migrate from one network access point to another network access point at a different location within the network without re-authentication, the method comprising:

means for storing migration permissions for migrating between individual network access points in the plurality of network access points, where the migration permissions establish migration rights between individual network access points in a plurality of network access points, said plurality of network access points configured to provide a computer access to a privately controlled computer network; and

means for determining whether to require the computer to re-authenticate in order to migrate from communicating with a first network access point in the plurality of network access points to a second network access point in the plurality of network access points based on a subscription level of the computer.

17. The system of claim 16, wherein the subscription level of the computer depends at least on the first network access point.

18. The system of claim 17, wherein the subscription level of the computer depends at least on the location of the first network access point.

19. The method of claim 16, further comprising, means for sending authentication request to the computer based on the determination.

20. The system of claim 16, further comprising means for receiving instructions for defining a plurality of zones, wherein each zone includes at least one network access point and wherein the subscription level of the computer depends at least on the zone of the first network access point.